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Summary 

Based on the ENSREG "Stress test" specifications, an assessment of the safety margins of the enrichment 
installation is performed by URENCO Netherlands BV (UNL), in cooperation with NRG. The results of 
this assessment are presented in this report. 

In this assessment, the response of UNL in relation to the following topics have been evaluated: 

• Earthquake 

• Flooding 

• Extreme weather conditions 

• Loss of electrical power 

• Other extreme hazards: 

o internal explosion 

o external explosion 

o internal fire 

o external fire 

o airplane crash 

o toxic gases 

o large grid disturbance 

o failure of systems by introducing computer malware 
o internal flooding 

• Severe Accident Management. 

It is noted that the ENSREG Stress Tests requirements were formulated for Nuclear Power Plant sites. It 
is therefore important to recognise the fundamental differences between a lower potential hazard site, 
such as the UNL site, and a higher potential hazard Nuclear Power Plant site. Given the nature of the 
UNL site, and the relatively low level of hazard posed by the activities undertaken, this document 
therefore presents a proportionate response to the ENSREG Stress Tests requirements. The report follows 
the suggested format for Stress Tests Reports, but is tailored as necessary where aspects are less 
significant or not applicable to the UNL site. 

In general, consideration of the ENSREG Stress Test requirements has concluded that there are no 
credible fault scenarios or cliff-edge effects at the UNL site for which there is not currently adequate 
provision. Additional measures are proposed in relation to earthquakes to increase the robustness of the 
plant. 
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Introduction 

Following the accident at the Fukushima nuclear power plant in Japan, the European Council declared 
that "the safety of all EU nuclear power plants should be reviewed on the basis of a comprehensive and 
transparent risk assessment (Stress test)". This review was later expanded to nuclear installations other 
than nuclear power plants. Based on this, the Ministry of Economie Affairs, Agriculture and Innovation 
(EL&I) requested URENCO Netherlands BV (UNL) to perform an assessment of the safety margins of 
the enrichment installation [1], based on the ENSREG specifications [2] [3] and the German ESK question 
list [4]. This request was implemented by UNL as the 'Complementary Safety Margin Assessment', 
which results are presented in this report. The approach of the 'Complementary Safety Margin 
Assessment' as proposed by UNL [5] has been approved by EL&I . The underlying report is in 
accordance with this proposal. 
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1 General data about site/plant 



1.1 Brief description of the site characteristics 



URENCO Netherlands BV (UNL) is situated on the south-east of the town of Almelo (see Figure 1-1), as 
part of an industrial area "Bornsestraat - Drienemanslanden". The site has an area of about 30 hectares. 




Figure 1-1 Location of the UNL site, south-east of Almelo 

At the north-west of the UNL site, on the other side of the Weezebeek (the blue coloured stream in Figure 
1-1), other companies are situated. One of these companies is Enrichment Technology Nederland B.V 
(ET NL), which is for 50% part of the URENCO Group. This company, with about 800 employees, can 
be considered as a fully separated company, although it has the same mother company as UNL. The other 
part of the industrial area contains various small companies. 
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The distance of the UNL site to the populated area of the city Almelo in the north-east is about 2 km and 
of the villages Bornerbroek in the west and Zenderen in the east about 3 km. In the northeast of UNL the 
penitentiary "Niendure" is situated, directly bordering the industrial area. 

South-west of the UNL site a railway is situated which forms an important transport route between the 
Netherlands and Germany. A few kilometres south of the UNL site the highway A1/A35 is situated. 
Fifteen kilometres south-east the airport Twente is situated. This airport is currently out of service and 
was formerly used for military airplanes. It may be used for civil airplanes in the near future. 

The UNL site in Almelo was founded in 1970. The site now employs around 260 people. Two enrichment 
plants, SP4 and SP5 (SP: Separation Plant), are in operation. Former plants SPI, SP2 and SP3 were fully 
decommissioned and brought back to green field sites. An overview of the site with its buildings is given 
in Figure 1-2. The current buildings are shown in green and in blue the buildings which are not yet build 
but which are already licensed are shown. 
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1 .2 Main characteristics of the facilities 

The maximum licensed capacity for the enrichment of uranium of UNL is 6200 tonnes Separative Work 
per annum (tSW/a). The feed material consists mostly of natural uranium, UNL uses maximum 20% 
reprocessed material per year. 

For the purposes of this report, three main groups of plant concepts are distinguished: 

• Centrifuge Enrichment Plants 

• Cylinder Storage Rafts and Container Receipt and Dispatch (CRD) 

• Other support facilities. 



Centrifuge Enrichment Plants 

UNL operates two centrifuge plants to deliver its core uranium enrichment services. Enrichment is not a 
chemical process, but a separation process based on physics: the difference in weight between the 
uranium isotopes. 

SP4 Plant 740 tSW/a current capacity. The plant was commissioned in 1981. The maximum 
enrichment for the SP4 plant is 5% of U-235. 

SP5 Plant 4770 tSW/a current capacity based on a more recently developed generation of 

centrifuges. The first cascade came on-line in 2000. Seven halls are currently in use . In 
total 9 halls are licensed. The maximum enrichment for the SP5 plant is 6% of U-235. 

The process material used at the UNL site is Uranium Hexafiuoride (UF 6 ). The UF 6 is transported to and 
from the UNL site, and stored on site, in robust, internationally approved transport cylinders which are 
ANSI N14. 1/ISO 7195 compliant. The cylinders are available as Type 48Y cylinders (48 inch diameter) 
and Type 30B cylinders (30 inch diameter). Figure 1-3 shows a Standard 30B UF 6 cylinder with on the 
right side of the cylinder the valve cover (the rectangular shape with 2 white stripes) which covers the 
isolation valve of the in/outlet of the cylinder. 
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Figure 1-3 Standard 30B UF 6 cylinder 

The enrichment process is in principle similar for both plants. The cylinders containing solid UF 6 are 
heated into the gaseous phase. The gaseous UF 6 is fed into the centrifuge cascades via a number of 
pressure reduction and control valves, where it adopts a rotational motion. The centrifugal forces push the 
heavier U238 closer to the wall of the rotor than the lighter U235. The gas closer to the wall becomes 
depleted in U235 (tails stream), whereas the gas nearer the rotor axis is slightly enriched in U235 (product 
stream). A distinct difference between the SP4 and SP5 plants is that in SP4 the feed cylinders are heated 
leading to liquid UF 6 and overpressure in the cylinders while in SP5 the UF 6 directly sublimes from solid 
UF 6 into gas with sub atmospheric conditions. For that reason are the feed cylinders in SP4 placed in an 
autoclave (airtight pressure vessel) as secondary containment. 

The streams are then pumped into a common header and combined for several cascades before being 
sublimed into cylinders which are chilled to a low temperature. This process is presented schematically in 
Figure 1-4. Figure 1-5 shows the concept of the ultracentrifuge. 
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Figure 1-4 Overview of the enrichment process 
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Container Receipt and Dispatch (CRD) and Cylinder Storage 

There are three CRD facilities: 

• Container Receipt and Dispatch Building CRDB is used as a handover point. Cylinders will be 
prepared for transportation and for feeding in the separation plants or temporary storage. 

• Container Receipt and Dispatch Building CRDC is used for the handover of feed and tail material 
cylinders as a back-up for the CRDB and it is used for storage and preparation of cylinders. 

• Container Receipt and Dispatch Building CRDD is planned to be built and will be used for the 
handover of feed and tail material cylinders as a back-up for the CRDB and will be used for 
storage of cylinders. 

There is also an open-air UF 6 storage on the site for UF 6 cylinders. This storage will be roofed next year 
as part of the extension of the CRDC, as licensed in august 2012. Already no UF 6 cylinders are stored in 
the open air anymore. 

The maximum amounts of UF 6 that are allo wed to be stored in total are: 

• Enriched material (product, > 1% U-235): 2.750 ton UF 6 

• Feed material (feed, 0,71 1-1 % U-235) and 

depleted material (tails, < 0,7 1 1 % U-235): 65.000 ton UF 6 . 

Other support facilities 

There are a number of facilities that support the two enrichment plants. The significant facilities include 
(see Figure 1-2): 

• UNL Office Building (UOB) 

• Security office 

• Central services building (CSB) housing the supporting facilities for the enrichment plants, 
including the blending facility, homogenization and sampling facility, analysis laboratory, 
cylinder cleaning and the wastewater treatment 

• Decontamination building (RCC) connected to SP4 

• Site Utility Building (SUB) for the power distribution and emergency power supply 
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• Station transformer for transformation from 1 lOkV to lOkV 

• In addition there is a transformation station nearby, owned by Enexis. 
Main potential hazards 

It is noted that the hazards associated with a release of UF 6 are predominantly chemotoxic. On release to 
the environment, UF 6 reacts with moisture in the air forming Uranyl Fluoride (UO2F2) and gaseous 
Hydrogen Fluoride (HF). The chemotoxic hazards are therefore primarily from gaseous HF and the heavy 
metal toxicity of uranium. 

UF 6 is, however, also the principal radioactive substance on the UNL site. Tails, feed and product are all 
stored in robust steel cylinders on site. The product cylinders will normally be stored on site for short 
periods only prior to dispatch to customers. Therefore is the amount of stored enriched material (product) 
limited. The product assay is limited to a maximum enrichment of 6% U235. Consequently, the main 
potential hazards relating to UNL enrichment operations are: 

• Release of UF 6 during fault conditions 

• Criticality arising from a fault condition. 

1 .3 Fundamental safety functions 

There are significant differences between the fundamental safety functions and support functions required 
for higher potential hazard nuclear power plant (NPP) operations compared with the lower potential 
hazards posed by operations at the UNL site. For NPPs, the three fundamental safety functions are: 

• Control of reactivity 

• Fuel cooling 

• Confinement of radioactivity 
and the key support functions are: 

• Power supply 

• Cooling through the ultimate heat sink. 
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There are no NPPs or spent reactor fuel on the UNL site. Decay heat removal systems are therefore not 
relevant to UNL operations as the fission products found in reactors and spent fuel stores are not present. 

Consequently, only control of reactivity and confinement of radioactivity are applicable to the UNL 
plants and their operation. Moreover, power supplies are not essential for maintaining UNL plant safety. 
The two relevant fundamental safety functions, control of reactivity and confinement of radioactivity, are 
captured in the following safety functional requirements: 

• Prevent criticality 

• Prevent a UF 6 release. 

UNL considers initiating events from both natural and man-made external hazards, including seismic, 
extreme weather (including flooding) and aircraft crash. Safety measures are identified depending on the 
consequences, including those arising from the potential for criticality and UF 6 release. 

The assessment of risks at UNL considers those arising during normal operations and fault conditions 
through a systematic identification and assessment process. The overriding objective for UNL plant safety 
is the elimination of hazards, by designing in inherent safety. Where this is not practicable, suitable and 
sufficiënt safety measures are identified to deliver the safety function following an initiating event. 

Engineered Structures, Systems and/or Components (SSC) are employed to deliver the safety functions 
wherever practicable together with robust procedural controls. These are chosen from a hierarchy of 
preferred characteristics such that there is adequate redundancy to accommodate single random failure 
and to minimize the likelihood of dependent failures. The design of plants, processes and operations is 
based on appropriate levels of defence in depth including diversity and physical separation. 

1.3.1 Reactivity control 

There are no NPPs or spent reactor fuel on the UNL site. Unlike NPPs, which are designed to operate 
critical and so require shutdown mechanisms to achieve sub-criticality, the safety aim throughout the 
enrichment process is to never achieve critical conditions when operating or during shutdown. In fact 
under all credible conditions, systems remain subcritical by a fair margin. 

The majority of operations on the UNL site involve UF 6 at natural enrichment levels or less (e.g. feed and 
tails cylinders) which do not present a criticality hazard under any conditions at the UNL site. The final 
product, low enriched UF 6 (<6% enrichment), does have the potential to cause a criticality. 
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The conditions for criticality are a combination of: 

• available mass of uranium 

• enrichment percentage of the uranium 

• geometrical conditions 

• presence of a moderator like water, H 2 , HF or carbon. 

The overriding objective is the elimination of hazards, by designing in inherent safety. The potential for 
criticality is very low and is minimized everywhere. The principal controls and safeguards to prevent and 
mitigate criticality can be summarized as [10]: 

• Overall conservatism in calculations used to determine sub-criticality limits 

• Use of geometrically favourable shapes to prevent criticality wherever reasonably practicable 

• Where safe geometries cannot be guaranteed, control of moderation and uranium quantities are 
the prime safety measures using engineered controls wherever practicable supported by 
procedural controls 

• Robust procedural controls defined through operating conditions and instructions 

• Maintaining safe separation distances between fissile material holdings 

• Monitoring. 

The combination of these controls makes a criticality incident incredible. 

Although it seems not possible to create a situation which would lead to a criticality incident, and hence 
the consequences of such a situation cannot be assessed directly, it is possible to give a general idea of 
what could be the consequences of a generic criticality accident. According to [6] a criticality accident 
(not occurring at a nuclear power plant), has consequences in a limited area. People that are actually next 
to an installation where a criticality occurs can suffer severe consequences, but already a few meters of 
separation reduces the consequences dramatically. For the situation of UNL this would mean that a 
hypothetical criticality accident would not exposé members of the public to dangerous levels of radiation. 
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1.3.2 Cooling Requirements 

There are no NPPs or spent reactor fuel on the site. Decay heat removal systems are therefore not relevant 
as fission products found in reactors and spent fuel stores are not present. 

Given the absence of a chemical or fission process on site only conventional heat loads are generated 
during the enrichment plant processes such as cylinder heating, building climate control, take off station 
and liquid sampling rig cooling and centrifuge motor efficiency losses. Once the centrifuge enrichment 
process has been terminated, cooling is not required. 

Cooling water is widely used to maintain optimum efficiency of the enrichment process and ensure the 
longevity of the centrifuge machines. Loss of cooling water or failure of the pumping systems would 
prevent continued operation, but will not result in any significant safety issues. To maintain the centrifuge 
enrichment facility and its process within the safety boundaries identified in the relevant safety case, no 
cooling water or any other coolant is required. 

In case of a leakage of UF 6 in an enrichment plant, the cooling of a take-off cylinder helps to draw off 
remaining UF 6 gas from the plant systems. This effect is however of very minor benefit. The cylinder 
storage buildings and other support facilities have no cooling requirements for safety purposes. 

Cooling of the enrichment units is therefore not required to maintain plant safety. 

1.3.3 Confinement of Radioactivity 

In contrast to NPPs, highly radioactive fission products are not created, stored or processed in a centrifuge 
enrichment plant and cannot therefore be released to the environment. The main radioactive materials 
present on the UNL site are UF 6 and its breakdown products. UF 6 may be present in solid, liquid or 
gaseous forms. Various contaminated forms are present including oils, residues and trap and filter media. 
If UF 6 is released or exposed to moist air it produces HF gas which together with the UO2F2 can disperse 
on and off-site. The main breakdown product, uranyl fluoride, is solid. It is widely recognized that UF 6 
presents a greater chemotoxic risk than a radiological risk. However, both risks are minimized when UF 6 
is contained. 

The fundamental safety principle when processing UF 6 is to maintain containment at all times during 
normal operations and to design and operate the plant so as to minimize the potential for a significant 
release in fault conditions, through isolation and safe removal of process gas. Any necessary plant 
discharges are via appropriate traps or filtration and monitoring systems before release through authorized 
routes to the environment. When handling uranium contaminated materials outside containment, area 
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ventilation and contamination control together with monitoring become the means of confinement. The 
robustness of the containment and defence in depth of other safety measures to prevent or mitigate release 
beyond confinement depends on the potential consequences of the release for the various plants, locations 
and forms of UF 6 . 

The principal controls and safeguards to prevent or mitigate release of radioactivity from confinement can 
be summarized as: 

• Robust design and integrity of cylinders and pipework systems commensurate with the level of 
potential hazard 

• Sub-atmospheric UF 6 processes wherever reasonably practicable 

• Secondary containment wherever UF 6 is in the liquid state and for super-atmospheric UF 6 
systems wherever reasonably practicable 

• Fail safe valve states to isolate and shutdown the enrichment process 

• Use of traps and filters 

• Ventilated areas and systems, including glove boxes and fume cupboards, where necessary and 
discharge monitoring 

• Area contamination control and monitoring. 

For a significant release of radioactivity to occur following severe damage, one or more of the following 
would need to occur: 

• Sufficiënt quantities of materials present in a dispersible form 

• Sufficiënt damage to containment to cause release 

• Ventilation or contamination control and monitoring systems by-pass. 



1.3.4 Power supply 

The power supply system on the UNL site provides power to the site for all UNL operations. Electrical 
power distribution to the significant buildings, plants, operations and processes is via a set of 
underground cables, grid yards, substations, transformers, and switch rooms, to form a power distribution 
system including earthing and lightning protection. 

The power supply system is important for company asset protection and provides no support to nuclear 
safety functions as all processes on-site are designed to shut down in a safe manner following loss of 
power. Some aspects of the system do, however, present a secondary hazard associated with the potential 
for a fire or explosion. 
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UNL has multi-redundant electrical supplies to site, to help ensure continued operation. However, in the 
event of total loss of all these electrical supplies operations will cease safely with or without operator 
intervention. 

The power supply from the grid enters the UNL site at 1 10 kV level. In a transformer station the voltage 
is decreased to 10 KV and distributed by underground cables to the significant buildings, plants, 
operations and processes. At the 10KV level the power distribution of the centrifuges is separated from 
the rest. 

In SP4, three emergency diesel generators are available: one system dedicated to SP4, one system 
dedicated to supporting facilities in the CSB and one common spare with a preference for SP4. SP4 has 
two Uninterruptable Power Supply (UPS) sets, which supply constant DC-power for e.g. computer 
systems and monitoring. The ventilation systems of the controlled area of SP4 and CSB are supplied by 
emergency power in case of loss of external power. The HF en alfa bèta air monitoring in SP4 and CSB is 
supplied by a UPS. 

In SP5, two back-up emergency diesel generators are available, each supplying four units. Each two units 
have a UPS. The ventilation systems in SP5 are supplied by one of the emergency diesel generators. The 
HF en alfa/bèta air monitoring in SP5 is supplied by the UPS. 

The recycle centre (RCC) has a dedicated emergency diesel generator for power supply to the ventilation 
systems of the controlled area. 

A separate emergency diesel generator is available for power supply to the site infrastructure like the 
security building, site security systems and outside lighting. 

Each plant has its own UPS system to power local control cabinets, computer equipment and monitoring 
systems in case of loss of external power. They are designed to power the consumers for at least 
30 minutes, in which time power supply will be restored by the diesel generators. 

1 .4 Scope and main results of Probabilistic Safety Assessments 

In the Safety Analysis Report (veiligheidsrapport) [10] a risk evaluation is reported for different 
scenarios. Basis for this risk evaluation is the combination of the maximum probability of occurrence of 
an accident and the radiological consequences on a location with the highest impact. As a basis for the 
risk evaluation the non-avoidable dose is applied which consists of: 

• 50 year dose including inhalation and radiation from the soil surface 
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• Dose resulting from consumption of contaminated crops on the first day. 

Acute radiation damage is excluded. In the calculation of the late effects a death risk of 5.0% per Sv is 
applied, in accordance with ICRP-60/ICRP-103. 

As part of the risk evaluation a set of design basis accidents is analysed, of which is determined that the 
maximum doses that can result from these accidents is within the limits that are applicable for their 
frequency of occurrence in the BKSE, article 18. The results are reported in the Safety Analysis Report of 
the UNL facility. 

As beyond design accident an accident with an airplane crash is analysed. The scenario with maximum 
impact is the crash of a military airplane (with fuel) on the open air storage of cylinders with UF 6 . 
Damage to 30 cylinders is assumed leading to a maximum 50-year dose at the site fence of 90 mSv, with 
a probability of occurrence of 5. 10" 7 /year. This results in a personal risk (risk of death due to late effects) 
of 2.10 9 per year. This is well within the criterion of the BKSE, article 18, which requires a maximum 
personal risk of 10 6 per year. 

Since recently no open air storage of UF 6 cylinders exist anywhere on site and all cylinders are stored 
inside. As before, the storage uses stacking of maximum 2 cylinders. The storage has a draining facility 
for kerosene to limit a possible kerosene fire in case of an airplane crash and the cylinders have a good 
resistance against fire. The inside storage results in equivalent or even lower consequences in case of an 
airplane crash. 
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2 Earthquake 

2.1 Design basis 

2.1 .1 Earthquake against which the plant is designed 

The area of the Netherlands has low seismic activity. Most activity is located in the south-east part, as can 
be seen in Figure 2-1 where the size of the spots indicate the magnitude of historie earthquakes 




O 100 2<JC ;. 

Figure 2-1 Earthquakes in the Netherlands in the period 1904-2004 
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(yellow spots indicate induced seismic activities, the dark red spots indicate tectonic activity before 1980 
and light red spots indicate tectonic activity after 1980). It can be observed in the figure that in the last 
century no seismic activity took place in the region of the UNL site (Almelo). 




Figure 2-2 



Seismic zoning map in EMS (left) and PGA (right) 



The UNL site lies in a zone with very low seismic potential. In Figure 2-2 seismic zoning maps for the 
Netherlands are shown for tectonic seismicity with a 10% probability of exceedance in 50 years (return 
period 475 years), given in European Macro-seismic Scale (EMS) and converted into peak ground 
accelerations (PGA). The indicated PGA zones have the following values: 

• Seismic Zone A: PGA = 0. 1 m/s 2 (0.0 1 g) 

• Seismic Zone B : PGA = 0.22 m/ s 2 (0.022 g) 

• Seismic Zone C: PGA = 0.50 m/ s 2 (0.050 g) 

• Seismic Zone D: PGA = 1.00 ml s 2 (0. 100 g). 

These PGA values occur not at ground level, but at the interface between the Holocene and Pleistocene 
geological layers. According to this categorisation the UNL site falls into seismic zone A, which means 
that a PGA of 0.01 g is applicable for this region. 
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Concerning the induced earthquakes it can be concluded that no induced earthquakes have taken place nor 
are they to be expected in the Almelo region because no oil and gas extraction takes places in this region. 

With concern to liquefaction in the UNL area: due to the low PGA of tectonic earthquakes and the 
absence of significant induced earthquakes, it is not likely that liquefaction can occur. 

Due to the stable geological situation, earthquakes are deemed too improbable to cause any serious 
consequences. For this, the UNL site is not specifically designed against earthquakes. The buildings of 
the UNL site are constructed according to the Dutch Building Act (Bouwbesluit). The (NEN) standards 
used in this Building Act lead to robust structures, which are able to withstand the accelerations that may 
be caused by low seismic activity. The Building Act requires the building to be able to withstand the 
ground acceleration caused by an earthquake that is postulated for a certain area. For Almelo the assumed 
ground acceleration according to the NEN-standard is 0.2 m/s 2 . 

2.1 .2 Provisions to protect the plant against the design basis earthquake 

The SSCs and provisions to maintain the fundamental safety functions are indicated below. 

The centrifuge pipework and cascades contain relatively small amounts of enriched material and 
moderator sources are limited. Fissile quantities with the potential for criticality primarily arise in the 
product take off stations, liquid sampling rigs and various traps and filters. The largest amounts of 
enriched UF 6 are available in the product cylinders. In relation to criticality, there are no limitations on 
proximity of adjacent product cylinders, and also not for external moderation by e.g. water in case of 
flooding, as described in the Safety Report [10]. 

The extent of cylinder damage following a seismic event depends on the resistance of the building and 
other significant structures and their potential to cause impact damage, such as cranes, and the location of 
the cylinder. A severe seismic event during cylinder transit within the centrifuge plants could result in 
crane collapse and/ or roof steel girder impact on the cylinder. Given that the cylinders are robust and are 
designed to withstand significant impacts, it is judged that there will be a spectrum of damage to the 
cylinder ranging from dents and scratches to a small loss of containment, but moderator sources are 
limited. Small losses of containment may also self-seal due to the formation of U0 2 F 2 as UF 6 reacts with 
moisture in the air. 

In case of a severe loss of containment of uranium due to a seismic event in the presence of water, it is not 
considered credible for a criticality to occur as this will result in material spreading across the floor into 
relatively thin slabs, which is not favourable for a criticality. Moreover a moderator must be supplied in 
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the right amount; too much would dilute the uranium and not cause criticality, too little would only react 
with the UF 6 to form HF which will escape. 

The cylinders in the feed, product and tails stations are locked by quick acting, fail safe valves. These 
valves are operated (and therefore tested) on a regular basis during normal operation. The safety circuit 
for actuation of the emergency stop (closing of the valves) is tested and maintained on a yearly basis. 

UF 6 is also present in the centrifuges and pipework in the cascade halls (in gas form). However, the 
amount of UF 6 is small due to the operating pressure far below atmospheric pressure. When the pipework 
and centrifuges are damaged, the release of only limited amounts of HF have to be taken into account. 
Since the formed solid UF 6 and small amounts of Uranylfluoride adheres within the system, releases of 
solids will be low. Also the building material provides a decontamination factor for any releases inside 
buildings by adherence of solidified UF 6 . Even a collapsed building would provide a similar factor. 
Therefore, only a limited amount of radioactive material may be released to the environment in the order 
of several kilograms UF6, leading to a maximum effective dose for persons at the site fence of less than 
0.1 mSv. 

2.1 .3 Compliance of the plant with its current licensing basis 

UNL has a maintenance system and operating procedures to ascertain the proper functioning of structures, 
systems and components. The safety settings are included in the Technical Specifications. No specific 
measures and procedures exist for (threatening) earthquake situations, nor are these deemed necessary. As 
there are no procedures and processes to deal with earthquake situations, there are no procedures that deal 
with mobile equipment and supplies that are planned for use. 

No serious threats from earthquakes for UNL are expected. The safety margins of the Dutch Building Act 
should be enough to withstand earthquakes exceeding the maximum PGA to be expected in this area, and 
therefore systems should remain intact. 

2.2 Evaluation of safety margins 

2.2.1 Estimation of safety margin against earthquake 

In section 2.1.1 it is evaluated that significant damage to buildings due to seismic activity is not likely to 
occur in the considered region. However, for the evaluation in this section a severe earthquake is 



23098/12.116030 



Confidential 



27/69 



postulated, which results in significant damage to buildings, installations and systems. The consequences 
of the postulated severe earthquake are described below for the relevant buildings. 

In SP5, a situation of severe damage may be possible when a roof steel girder impacts on the UF 6 
systems. However, since the total pipework is at under pressure, air leaks into the system when pipes are 
damaged. This will result in formation of small amounts of HF. The fast automatic valves will 
subsequently close because of the lost under pressure (and also in case of loss of electrical power), which 
isolates the feed line from the pipework. For SP5 there is no significant potential threat due to the 
described situation. 

For SP4 the highest potential threat is a steel girder impact on the feed line between the autoclave and the 
hotbox in which the UF 6 -gas is not in underpressure. The isolation valve will also close when power 
supply to the autoclave is disconnected. Since this power supply is located directly above the threatened 
feed lines, it can be assumed that it will be disconnected when the feed line is damaged and as a result the 
isolation valve will close. 

In the Product Facility (CSB; blending, homogenising and taking samples), like in SP4, cylinders with 
overpressure and liquid UF 6 within autoclaves are present. The worst case for these cylinders is that the 
motor controlled valve is not operated after a pipe leak or break, due to lack of emergency power. Since 
the pneumatics are ATO (air to open) the valve will however close automatically. Therefore only the pipe 
content is released, leading to small amounts of HF gas and Uranylfluoride. 

Cylinders in storage may be damaged at their isolation valve. As described in section 2. 1.2, the 
consequences of this are small. 

It can be concluded that for the situation of damage induced by a postulated severe earthquake, systems 
could fail resulting in release of a limited amount of radioactive material to the environment in the order 
of several kilograms UF6. This would lead to a maximum effective dose for persons at the site fence of 
less than 0. 1 mSv. 

The consequences of such an accident can be derived from the consequences of scenarios described in the 
Safety Analysis Report of UNL. The consequences are far below the beyond design airplane crash 
scenario, with respect to radiological as well as chemical consequences. 
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2.2.2 Measures which can be envisaged to increase robustness of the plant against 
earthquakes 

At the UNL site it is very unlikely for earthquakes to occur and the possible consequences of a postulated 
earthquake are relatively small. However, since a postulated earthquake may lead to consequences due to 
a damaged feed line in SP4, which is not at underpressure, the robustness can be increased on this point. 

A mitigating project would be to realize underpressure of UF 6 already in the autoclaves before feeding 
into the hotbox. UNL has planned to start such a project in 2013. 
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3 Flooding 

This chapter describes the outline of the analysis of the UNL site with respect to flooding conditions. The 
flooding conditions considered are: 

• Inundation by the local stream the "Weezebeek" 

• Extreme rain fall. 



3.1 Design basis 



3.1 .1 Flooding against which the plant is designed 

Due to the geographical location and the ensuing impossibility of having a serious flooding in this area, 
flooding was not taken into account in the design basis. The UNL buildings are not specifically designed 
against a postulated flood height. Flooding characteristics of the site are described below. 

The ground le vel of the buildings area is at least 1 1.5 m above NAP (Nieuw Amsterdams Peil), the floor 
levels of the buildings are 1 1.85 m above NAP. The pasture on the western side of the area is 
approximately 1 m below the ground level of UNL. An elevation map of the UNL area and its 
surroundings is given in Figure 3-1. In this figure the UNL building and storage area where uranium is 
present is indicated by the red line. See Figure 1-2 for a more detailed overview of the site. 
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Figure 3-1 Elevation map of the surroundings of the UNL site. The red line indicates the building and storage area 

In Figure 3-2 and Figure 3-3 indicative inundations with a frequency of occurrence of once per 100 years 
and once per 5000 years, are given for the "Weezebeek" stream. This is calculated with the 
"Reggemodel", a combined precipitation/drainage model containing all main water ways in the Regge 
bassin. 

It can be noticed that next to the site in westward direction, water collects due to water elevation of the 
local stream. It is estimated that the water le vel may rise to a height of between 10.7 m (southern stream) 
and 10.9 m (northern stream) NAP once per 5000 years. This height is well below the 1 1.5 m and 1 1.85 
m respectively the ground- and floor level of the UNL buildings. 
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Figure 3-2 Indicative inundations once per 100 years. The red line indicates the UNL building and storage area, the blue 

spots represent water areas 
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Figure 3-3 Indicative inundations once per 5000 years. The red line indicates the UNL building and storage 

area, the blue spots represent water areas 



It is not expected that extreme rainfall can cause serious inundation of the UNL buildings. Water from 
rainfall will flow by the roads to the sewer or to lower area' s and will not pass any relevant buildings on 
its way downward. 

In case of water ingress to the plants, it would spread across the floors and a localised build up is not 
deemed possible. 
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The most likely effect of flooding within an enrichment plant is loss of electrical supplies. Electrical 
supplies are required for continued operation, but the plant is designed to fail to a safe state upon loss of 
electrical supply and would not require cooling. Without electrical supplies to provide the motive force 
(heating and pumping) to drive the UF 6 around the plant, the UF 6 solidifies and radiological risks are 
reduced. 

Conclusion on the adequacy of protection against external flooding 

Due to the maximum height of flood considered possible on the site in view of the historical data and the 
best available knowledge on the physical phenomena that have a potential to increase the height of flood 
in combination with the height level of the site, flooding does not form a realistic threat to UNL. 
Existing measures such as drains are considered adequate. The likelihood and possible consequences of 
credible flooding on the UNL site do not warrant any further measures. 

3.1 .2 Provisions to protect the plant against the design basis flood 

Since the UNL buildings and installations are not specifically designed against a postulated flood, no 
specific provisions are available. 

3.1 .3 Plant compliance with its current licensing basis 

UNL has a maintenance system and operating procedures to ascertain the proper functioning of 
structures, systems and components. The safety settings are included in the Technical Specific ations. No 
specific measures and procedures exist for (threatening) flooding situations, nor are these deemed 
necessary. As there are no procedures and processes to deal with flooding situations, there are no 
procedures that deal with mobile equipment and supplies that are planned for use. 

3.2 Evaluation of safety margins 

3.2.1 Estimation of safety margin against flooding 

As stated in the paragraphs before there is no credible possibility for flooding of the relevant buildings. In 
order to make a margin assessment the flooding of the UNL site with 1 meter water is postulated. In this 
case all buildings will be flooded. It cannot be proven that the electrical power supply will function in this 
case so a loss of all electrical power is assumed. 
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A postulated severe condition as a flooding of lm can have several consequences: 

1 . The water acts as a reflector on the outside of a cylinder or system 

2. The power supply will stop. 

In the design criticality aspects are considered. Criticality safety assessments already assume water 
reflection, therefore flooding has no effect upon the calculated safety margins. 

The autoclaves, cylinders, centrifuges and connecting pipework are waterproof. When no power is 
available, the UF 6 -systems are automatically switched to "safe positions" ensuring that all UF 6 is kept 
within the production equipment. Ventilation and control systems will be switched off. 

No specific operating provisions are available to be used in case of an inundation of the site. However, 
the production process will be shut down in case of serious water threat and no further actions are needed 
for safety. 

Flooding of the area does not threat the situation outside the plant. Water collects at the western part next 
to the plant, which makes the site normally accessible for personnel and equipment by use of the intact 
infrastructure from other directions (see also Figure 3-3). 

Since no large water masses are available in the vicinity of the plant, a flooding will be a slow process. 
This means that no damage to the buildings and systems due to impact forces needs to be assumed. In 
chapter 5 it is concluded that no serious consequences result from the loss of electrical power. As stated 
above, the water level is no reason for criticality in the systems or cylinders with UF 6 . 

It can be concluded that there is a substantial margin beyond any credible flooding level and no cliff-edge 
effect is to be expected. 

3.2.2 Measures which can be envisaged to increase robustness of the plant against 
flooding 

At the UNL site there is no relevant possibility for flooding and the possible consequences of a 
postulated flooding are small. Therefore no measures to increase the plant robustness against flooding and 
enhance plant safety are considered necessary. 
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Extreme weather conditions 



4.1 Design basis 

This chapter describes the design basis of UNL with respect to extreme weather conditions. The 
following weather conditions are taken into account: 

extreme high and low air temperatures 
extremely high wind (including storm and tornado) 
wind missiles and hail 
heavy rainfall 
heavy snowfall 
formation of ice 
lightning 

credible combinations of the conditions mentioned above. 



4.1 .1 Reassessment of weather conditions used as design basis 

The data on extreme weather conditions is collected at the KNMI weather station at the former airport of 
Twente [7] which is located 15km from UNL. The data is collected between 1951 and the present. 

Extreme high and low air temperatures 

The maximum air temperature measured is 36.0 °C on 08-08-2003. Research has shown that maximum 
expected air temperature in the Netherlands may increase to approximately 40 °C in the next 100 years. 
No adverse consequences will result from such temperatures for the safety of the plant. 

The lowest air temperature measured is -21.6 °C on 26-02-1956. At extremely low outside air 
temperatures the following effects must be avoided: 

• decrease in the quality of the diesel fuel inventory 

• freezing of coolant for the diesel generators 

• freezing of the fire extinguishing water inventory. 
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For the facilities of UNL, outside air temperature has not been retrieved as design basis. In general, for 
systems important to safety, sufficiënt resistance against low temperatures is guaranteed by design. 

Extremely high wind (including storm and tornado) 

The wind load to which the building constructions of the UF 6 -areas are resistant is calculated according to 
the NEN6702 'Technische Grondslagen voor Bouwconstructies' (TGB). 

For wind types, the following subdivision is used: 

• Extreme wind speed (10 minutes average) 

• Wind gusts (usually less than 20 seconds) 

• Whirlwinds (unpredictable). 

Extreme wind speed 

The highest wind speed measured is 24.7 m/s on 23-12-1954. Research shows that the maximum wind 
speed (hourly average) that can be expected once every 10,000 years is approximately 34 m/s [8]. 

Wind gust 

A wind gust is a sudden, brief increase in speed of the wind. The duration of a gust is usually less than 20 
seconds. KNMI has determined that the maximum wind gust is roughly 1.5 times the maximum hourly 
average wind speed. At a wind speed of 34 m/s, this results in a maximum wind gust of 51 m/s once 
every 10,000 years on average. The highest wind gust measured is 35 m/s on 27-10-2002. 

Whirlwind 

The highest wind speed that was observed by a monitoring station due to a whirlwind in the Netherlands 
is 56 m/s. On average, each year about two whirlwinds cause some damage to the infrastructure 
somewhere in the Netherlands, over an area of one square kilometre. It is estimated that for a random 
location in the Netherlands, the risk of damage by a whirlwind is 10 5 per year [9]. 

For further evaluation of the structural building integrity, an enveloping wind speed of 56 m/s is adopted. 
Consequences 

The plates of the facade and roof of the buildings could be damaged by wind gusts or a whirlwind. 
Damage to the steel construction of the building is not credible. Released plates of the building, which fall 
directly on a UF 6 pipeline, may cause damage to this pipeline. The maximum credible consequences 
result from a major pipe break in an area with UF 6 systems in sub atmospheric pressure. Damage to 
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pipelines with UF 6 above atmospheric pressure is not credible because the areas with UF 6 above 
atmospheric pressure are located in the centre of the buildings. 

The consequences are described as part of the description of internal accidents in the Safety Report [10]. 
It is concluded that even in the case of a break of a pipeline with UF 6 above atmospheric pressure (see 
2.2.1) no chemotoxic or radiological consequences are to be expected for people in the area surrounding 
the plant. 

Wind missiles and hail 

Wind missiles are projectiles propelled by extreme wind. A credible effect caused by projectiles could be 
loss of offsite power due to damage to the power lines or the switchyard. This type of event is included in 
the loss of offsite power sequences (see Chapter 5). Other effects that may be caused by wind missiles 
will be comparable to the impact of released building plates caused by extremely high wind. 

Hail is defined as precipitation in the form of spherical or irregular pellets of ice larger than 5 mm in 
diameter. Depending on the size of the pellets, some damage to objects can be expected. It is concluded 
that hail has no major impact on plant safety. 

Heavy rainfall 

Extreme rainfall may induce additional force on building roofs. Because of raised edges water can 
accumulate on top of the buildings if all drainage pipes are blocked. The largest recorded amount of 
rainfall in one hour in Twente is 27.6 mm on 26-08-2010. The largest amount of rainfall in one day is 
106.4 mm on 11-09-1988. 

The statistics of the KNMI show that for the area of Almelo once every thousand years (10~ 3 per year) 
100 mm of rainfall can be expected within a period of 24 hours [11]. For the same conditions, 1 14 mm of 
rainfall can be expected within 48 hours. 

The facilities are designed in conformance with NEN6702 'Technische Grondslagen voor 
Bouwconstructies' (TGB), which requires a roof load resistance of 1.0 kN/m 2 . A maximum rain flow is 
given of 0.054 1/s/m 2 . To drain the water from the roofs there are drain pipes and in case these are blocked 
the water can flow away through emergency drain openings in the raised edges of the roofs. 

In 2005 the resistance of the roofs and the required number of drains of the roofs is checked by DHV. 
Several recommendations were given for increasing the number and size of the emergency drain openings 
on the roofs. With these additional drains the water accumulation on the rooftops above the allowed loads 
is not credible. 
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Extreme rainfall may also lead to flooding. This topic is covered in chapter 4. 
Heavy snowfall 

Heavy snowfall may lead to accumulation of snow on roofs, inducing a load on the civil structure. All 
building structures are designed to withstand the credible consequences of snowfall. Building Standard 
NEN 6702 specifies a maximum snow load on flat roof tops of 0.56 kN/m 2 ; which corresponds to a level 
of fresh snow of approximately 0.56 m. On average, occasions of more than 20 cm of snowfall occur once 
every 10 years and more than 35 cm occurs once every 50 years [7]. However, if it continues to snow for 
an extended period, larger values of snow build up can be expected. Also, if snow thickens due to 
alternating high and low temperatures, density may increase. The highest snow load measured at KNMI 
station Twente in the last 50 years was on 25 and 26 November 2005, the maximum load equivalent was 

0. 52 kN/m 2 . However the maximum load is below the NEN 6702 load, although the margin is not very 
large. 

Formation of ice 

Formation of ice on the Weezebeek is a common process that can be expected every year. Severe ice 
formation occurs less frequently. The formation of ice on the Weezebeek does not influence the safe 
operation of UNL. 

Lightning 

Lightning strike may have an impact on electrical systems such as the I&C of UNL. Lightning occurs on 
average 2 to 3 times per km 2 /year. Lightning strikes occur in the region of UNL approximately 24-26 
days a year [7] . Lightning has never been an issue for the safety of UNL. The buildings of UNL are 
equipped with lightning protection, which is connected to the grounding points. The protection is in 
accordance with the regulations that were applicable at the time of construction, like NEN 1014 or NEN- 
EN-IEC 62305. 

Credible combinations of the conditions mentioned above 

1 . Snow + extreme wind, 

2. Extreme wind + extreme rainfall + lightning. 

Ad 1 . Snow and wind combined may lead to clogging of air vents (ventilation, diesel generators air 
intake) 
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Ad 2. High winds, combined with extreme rainfall and lightning can be expected during a thunderstorm. 
Because the loads caused by these weather conditions are different, they will not reinforce each other's 
effect on the plant. 

Conclusion on the adequacy of protection against extreme weather conditions 

The separate phenomena are discussed in paragraph 4.1.1. It can be concluded that no serious 
consequences are to be expected from these phenomena. 

4.2 Evaluation of safety margins 

4.2.1 Estimation of safety margin against extreme weather conditions 

This paragraph contains an analysis of the potential impact of different extreme weather conditions on the 
reliable operation of the safety systems of UNL. The safety margin is defined as the difference between 
the allowable load (by design and/or by building Standard) and the maximum load on buildings that can 
be expected as a result of the extreme weather conditions. Loads due to snowfall, rainfall and wind are 
derived from the weather conditions listed in the previous section. The remaining conditions (air 
temperature, formation of ice and lightning strike) cannot be translated into explicit loads on buildings 
and are only qualitatively discussed (i.e. not quantified). 

Extreme high and low air temperatures 

Extreme high outside air temperatures will not cause any problems for UNL due to the fact that cooling is 
not a main safety issue. The UF 6 in the cylinders has a triple point at 64°C, which gives a sufficiënt safety 
margin to the highest outside air temperatures. 

Extreme low air temperatures will not have an effect on the systems which are essential for confinement 
and prevention of criticality. Low temperatures may have an impact on the diesel generators, but these are 
located inside the buildings and therefore not vulnerable for low temperatures. In addition, the diesel 
generators are not needed for safety (see chapter 5). 

Extremely high wind (including storm and tornado) 

No cliff-edge is expected concerning the failure of the buildings due to either maximum credible wind 
gusts or whirl winds. 
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Wind missiles and hail 

No cliff-edge is expected concerning the failure of the buildings due to either wind missiles or hail. No 
quantifiable margin for wind missiles and hail can be given. 

Heavy rainfall 

In case of blockage of the normal water drain pipes of the roofs during heavy rainfall, the water will be 
drained by the emergency drain openings. This gives considerable margin concerning heavy rain fall. In 
the incredible case that water is accumulated on a roof above the maximum load, the roof may collapse. 
This may lead to damage to one or a few pipelines containing UF6. The cylinders or autoclaves 
containing UF6 are sufficiently robust and will not be damaged by this. The possible consequences are 
described as part of the description of internal accidents in the Safety Report [10]. It is concluded that 
even in the case of a break of a pipeline with UF 6 above atmospheric pressure no chemotoxic or 
radiological consequences are to be expected for people in the area surrounding the plant. In case of 
multiple breaks of pipelines only a limited amount of radioactive material may be released to the 
environment of maximum a few kilograms UF6. This would lead to a maximum effective dose for 
persons at the site fence significantly below 0. 1 mSv. 

Heavy snowfall 

The safety margin for snowfall resistance of buildings is depicted in Table 4-1 in relation to the maximum 
load as required by NEN 6702 (0.56 kN/m 2 ). The maximum measured snow load is 0.52 kN/m 2 . The 
maximum allowable load is calculated in 2006 by DHV. 

Table 4-1 Snowfall resistance of buildings 



Building 


Allowable load 
(kN/m 2 ) 


Margin in relation to NEN 
norm (kN/m 2 ) 


Margin in relation to maximum 
measured snow load (kN/m 2 ) 


SP4 


0.6 - 0.8 


0.04 - 0.24 


0.08 - 0.28 


SP5 


0.6 - 0.8 


0.04 - 0.24 


0.08 - 0.28 


CRDB 


0.65 - 0.78 


0.09 - 0.22 


0.13-0.26 


CRDC 


0.56 





0.04 



Table 4-1 shows that snowfall is not a safety issue for UNL. In case of conditions involving snow and ice, 
the civil department inspects building integrity on a daily basis and removes snow if necessary. 
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Formation of ice 

Formation of ice is not considered a problem because cooling is not a safety system for UNL. Due to the 
small size of the Weezebeek, drifting ice is not an issue. No quantifiable margin for ice formation can be 
given. 

Lightning 

If the plant is subjected to lightning pulses with amplitudes above the designed levels, damage or spurious 
actuation of I&C safety channels may be initiated. In an unlikely case this might lead to the shutdown of 
several systems or a situation of loss of off-site power (see chapter 5), but not resulting in off-site 
consequences. 

4.2.2 Measures which can be envisaged to increase robustness of the plant against extreme 
weather conditions 

No measures are deemed necessary to increase the robustness of the plant against extreme weather 
conditions. 
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5 Loss of electrical power 

In this chapter the consequences of loss of off-site power and loss of total AC power are described. For a 
description of the power supply system section 1.3.4 can be used as a reference. 

5.1 Loss of power 

Loss of off-site power 

In case of loss of off-site power several emergency diesel generators and UPS's are available to prolong 
on-site AC power for relevant (support) systems. A safety principle applied in the design of a URENCO 
Centrifuge Enrichment Facility is that UF 6 systems revert to a fail-safe state upon power outage. 

Any disruption in the electrical power supply of the centrifuge enrichment facility will result in coast 
down of the centrifuges and shut down of the feed systems. The systems are designed to shut down in a 
safe manner following loss of power and the process and work activities are automatically stopped. All 
systems will switch to the fail mode and the UF 6 inventory will be evacuated via appropriate traps and 
filters. No safety systems needing power supply are necessary and confinement and subcriticality of UF 6 
are ensured. 

When no off-site power is available for a longer period (days) the installation will stay in the shut down 
situation. No additional measures are needed for safety reasons. 

Loss of off-site power and loss of the back-up AC power source 

In the event of total loss of all AC electrical supplies, the situation is in relation to safety the same as 
described above. The operations will cease safely with or without operator intervention. Confinement and 
subcriticality are ensured in the fail safe position of the systems. 

The monitoring and alarm systems are supplied by the UPS for at least 30 minutes. 
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5.2 Evaluation of safety margins 

5.2.1 Conclusion on the adequacy of protection against loss of electrical power 

The two essential safety functions for UNL, confinement of radioactivity and prevention of criticality, are 
ensured during loss of power. This is due to the design of the plant safety systems which automatically 
revert the UF 6 systems to a fail-safe state upon power outage. 

5.2.2 Measures which can be envisaged to increase robustness of the plant in case of 
loss of electrical power 

No measures have been identified. 
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Other extreme hazards 



6.1 



Selected events 



The folio wing extreme events were identified for this analysis: 

• explosion and fire related hazards: 

o internal explosion 

o external explosion 

o internal fire 

o external fire 

o airplane crash 

o toxic gases 

• electrical related issues: 

o large grid disturbance 

o millennium-bug kind of failure of systems, renamed as failure of systems by introducing 



• water related issues: 

o internal flooding. 

The folio wing information is elaborated for each of these hazards: 

• General description of the event 

• Description of how the event could lead to consequences for the safety systems 

• Elaboration on these consequences. 



Internal explosions are defined as being those explosions that originate from plant systems and plant 
storages. To protect safety relevant systems against the impact of internal explosions, the following 
measures are included in the design to prevent occurrence of internal explosion and to reduce their 
impact: 



computer malware 



6.2 



Internal explosion 
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• Application (as far as possible) of inflammable gases and liquids instead of more obvious but 
combustible ones 

• Reduction of number and volume of explosive materials 

• Limitation of the releases of explosive materials in case of disturbances 

• Special precautions for the storage of explosive materials 

• Monitoring of risk areas combined with automatic safety measures 

• Ventilation of risk areas. 



Table 6-1 Present toxic or harmful substances 



Substance 


Amount 


Classification 


Location 


UF 6 


Approx. 68 000 ton 


Toxic 


UF 6 storage, SP4, SP5, CRDB, CSB 


Nitrogen 


50 m3 


Harmful 


Between SP4 and CSB 


Argon 


10 m3 


Harmful 


Between SP4 and CSB 


Diesel 


Approx. 50 m3 


Harmful/flammable 


SP4, SP5, RCC, SUB 


Various chemie als 


10 ton 


Toxic/flammable 


Chemical storage; CSB 


Gas cylinders 


Approx. no. 190 


Toxic/flammable 


CSB and several locations 


Ammonia 


0,26 ton 


Toxic 


CSB near blending station 



The emergency diesel generators are described in section 1.3.4. Fuel tanks are located inside and outside 
(underground) the buildings. 

The risk of an internal explosion at UNL can be described by the following scenarios: 

• Explosion of diesel near the separation plants 

• Explosion in the chemie al storage building 

• Explosion in the Separations Plants. 

Due to the presence of explosions shutters, the distance of the chemical storage building to the UF 6 
sources and limited UF 6 mass in the Separation Plants, major consequences due to an internal explosion 
should not occur. Persons might be (a little) injured in the near area of the incident. This can be injuries 
by the exposure of heat or injuries due to the explosion shockwave. The internal explosion can also cause 
risks for the confinement of radioactivity. In a worst case scenario there can be a break of one or a few 
UF 6 pipelines due to an internal explosion. The consequences of this are described as part of the 
description of internal accidents in the Safety Report [10]. It is concluded that even in case of a break of a 
pipeline with UF 6 above atmospheric pressure, no chemotoxic or radiological consequences are to be 
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expected for people in the area surrounding the plant. In case of multiple breaks of pipelines only a 
limited amount of radioactive material may be released to the environment of maximum a few kilograms 
UF6. This would lead to a maximum effective dose for persons at the site fence significantly below 
0.1 mSv. 

6.3 External explosion 

Explosion pressure waves can generally result from accidents in nearby facilities or means of 
transportation. The potential damage can result from pressure wave impact. 



The risks of the surrounding area are shown in the risk map of the area around UNL in Figure 6-1. 




Figure 6-1 Risk map of the UNL area [12] 

The risk map of Figure 6- 1 shows the potential risks of the surrounding area. The UNL f acility is located 
in the centre of the map. This risk map shows that external explosions may originate from: 

• The main gas pipeline (east) 

• ETNL site (north-west) 

• Transport via the rail road Almelo-Hengelo (south). 

Besides the risks from the risk map, also an additional risk is discussed: 

• Transport via the road N743 and the Drienemansweg (north). 
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6.3.1 Main gas pipeline 

The distance of the URENCO buildings to the main gas pipeline is approximately 400m. The legal 
Standard for high pressure gas pipelines is a 10 6 risk contour which is 5 meters from the pipeline. For this 
specific pipeline the 1CT 6 risk contour is even smaller (Om) [12]. Because of the distance to the pipeline, 
the shockwave due to an explosion of the main gas pipeline will be strongly decreased at that distance. 
The risk for the confinement of radioactivity due to an external explosion will therefore be negligible. 

6.3.2 ETNL site 

An outdoor storage is located on the ETNL site. The hazardous substances available on the terrain of 
ETNL are shown in Table 6-2. 



Table 6-2 Present substances at ETNL site 



Substance 


Amount (kg) 


Hazardous waste 


52.000 


Resin and hardeners 


30.000 


Leach 


15.000 


Acids 


15.000 


Oil 


15.000 



The ETNL storage is in accordance with guideline CPR15. The mentioned substances are flammable but 
do not result in direct explosive risks. In Figure 6-1 the 10~ risk contour is shown. The contour covers a 
small part of the UNL terrain, but in this part no buildings are located [12]. The buildings of UNL are 
thus outside of the 10~ 6 risk contour. The risk for confinement of radioactivity is therefore negligible. 

6.3.3 Transport by the road and rail 

Transport of gasses takes place via the rail road Almelo-Hengelo, the road N743 and the road 
Drienemansweg. Via these transportation routes, substances like flammable gasses and toxic gasses 
(chlorine) are transported [13]. The 'Risicoatlas Spoor' [14] shows that the individual risk of transport by 
rail is 10" /yr at a distance of less than 10 meters from the centre of the rail road. A gas explosion, caused 
by an accident with a fuel truck or fuel train, may occur locally. The distance from the main road and the 
rail to the UNL facilities is approximately 200m. 
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In the case that a leakage of explosive gas from a train will not explode directly, the possibility occurs 
that during specific weather conditions a cloud of explosive gas is driven by the wind to the UNL terrain. 
This cloud of explosive gas can be ignited by for example the electrical systems at the UNL site. It is 
unknown if the concentration can exceed the lower explosion limit. 

An explosion of explosive gas at or near the UNL site may result in damage to the outside of the 
buildings. In a worst case scenario there can be a break of one or a few UF 6 pipelines due to the damaged 
construction. As stated before, the consequences are described as part of the description of internal 
accidents in the Safety Report [10]. It is concluded that even in case of a break of a pipeline with UF 6 
above atmospheric pressure, no chemotoxic or radiological consequences are to be expected for people in 
the area surrounding the plant. In case of multiple breaks of pipelines only a limited amount of 
radioactive material may be released to the environment of maximum a few kilograms UF6. This would 
lead to a maximum effective dose for persons at the site fence significantly below 0. 1 mSv. 

6.4 Internal fire 

The risk of an internal fire is very small because the amount of combustible inventory in the facilities 
with UF 6 -systems is insufficiënt to cause a discharge of UF 6 as a result of the fire. Furthermore, the 
cylinders containing large amounts of UF 6 have a high heat-resistance (at least 30 minutes at 800°C). The 
facilities where more combustible material (like oil and other chemicals) is present are accommodated 
with fire detection systems. Uranium is not present here or only in very small amounts. A possible fire 
will not expand to UF 6 -areas due to compartmentalisation, detection and repression. 

DHV has additionally investigated the possibilities of the initiation and propagation of an internal fire in 
SP5. The conclusion of above-mentioned report is that all installations of SP5 are compliant to the 
construction regulations, and the risk of an internal fire is very small. Such a fire will have no chemotoxic 
or radiological consequences for people in the area surrounding the plant. 

For the repression of an initiating fire UNL has a BHV-fire watch which can use one of the fire stations 
on the terrain where protecting clothing, oxygen bottles/masks and fire extinguishing systems are 
available. Throughout the UNL terrain there are approximately 500 fire extinguishing hoses located. 
There are approximately 500 C0 2 fire extinguishers and 150 foam fire extinguishers. 

In case of a fire the extinguishing water will be discharged via the rainwater drainage into the Weezebeek. 
The risk of a fire is small and the risk of a release of large amounts of UF 6 via the extinguishing water in 
the case of a fire is extremely small. 
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6.5 External fire 

The risks of the surrounding area are shown in the risk map of the area around UNL in Figure 6- lof 
section 6.3. The risk of an external fire results from the same sources as the risk of an external explosion, 
which originates from: 

• The main gas pipeline (east) 

• ETNL site(north-west) 

• Transport via the rail road Almelo-Hengelo (south) 

• Transport via the road N743 and the Drienemansweg (north). 

A major influence on the spreading of an external fire is the wind direction. The wind rose of Figure 6-2 
shows that the main wind direction is south-west. This decreases the chances of above-mentioned sources 
of external fires. 



Wind rose Twenthe, Year climatology 
1 January to 31 December (time period 1971-2000) 

N 




Figure 6-2 Wind rose, measured at KNMI station Twenthe [7] 

6.5.1 Main gas pipeline 

The distance to the main gas pipeline is approximately 400m. The area between the UNL site and the 
main gas pipeline consist mainly of agricultural ground. The fire load of the agricultural grasses and crops 
are so low that spreading of the fire from the main gas pipeline to the UNL buildings through this way is 
not possible. 
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6.5.2 ETNL site 

An outdoor storage is located on the ETNL site. This storage contains the substances mentioned in 
chapter 6.3.2. In Figure 6-1 the 10 6 /yr risk contour is shown, which covers a small part of the UNL 
terrain where no buildings are located. Between the ETNL and UNL sites the brook 'Weezebeek' flows, 
which is approximately 4 to 5 meter wide. Both banks of the Weezebeek are covered with short grass 
which does not make the transportation of a fire via the ground possible. 

Ignition of the UNL buildings by external fire at the ETNL site is possible, however only by indirect 
means (sparks). The UNL facilities are mainly made of steel and have as such a very low probability of 
catching fire. Also the wind rose of Figure 6-2 shows that the chance of wind directly from the ETNL site 
to the UNL site (north-west) is small. 

Due to the short distance of the ETNL site to the URECO site the influence of smoke and heat production 
should be considered. Both heat and smoke will have influence on the ventilation system of the UNL 
facilities. Smoke and heat will not directly influence the safety systems, but will influence the safety of 
personnel of the UNL site. Evacuation of personnel at the UNL site due to fire at the ETNL site will 
however not cause any safety concerns. 

6.5.3 Transport by the road and rail 

Transport of liquefied gasses takes place via the rail road Almelo-Hengelo, the road N743 and the road 
Drienemansweg. The distance from the road and the rail to the UNL facilities is approximately 200m. 
The area between the UNL site and the road and the rail consists mainly of agricultural ground. The fire 
load of the agricultural grasses and crops are so low that a spreading of the fire from the road and the rail 
to the UNL buildings through this way is not possible. 

6.6 Airplane crash 

Fifteen kilometres south-east from the UNL site the airport Twente is situated. This airport is currently 
out of service and was formerly used for military airplanes. It may be used for civil airplanes in the 
future. 

In the safety report of UNL [10] several different airplane crash accidents (beyond design accidents) are 
discussed. The extent of the damage by an airplane crash is calculated based on conservative assumptions 
leading to a maximum discharge and the most adverse consequences for the neighbourhood. 
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The airplane crash possibilities that are considered are: 

a) A plane, filled with fuel, crashes on a row of autoclaves with UF 6 -containers 

b) The plane crashes as mentioned above but without fuel 

c) A plane, filled with fuel, crashes on a row of UF 6 -containers on the outside storage 

d) The plane crashes as mentioned above but without fuel. 

For each case the flying direction and angle are chosen in such a way that a maximum number of 
containers is hit. The influence of the fuel is related to the weight of the plane and heat production of the 
crash and folio wing fire. A large heat production due to a fire will result in a larger plume rise of released 
UF 6 which decreases the effect for the direct surrounding terrains. 

The cases are calculated with a heavy military airplane (type Phantom) as a reference plane. The effect of 
a large passenger airplane is not calculated but will only be discussed briefly. The expected differences 
between a military airplane and a passenger air plane are: 

• The passenger air plane has a larger weight but the speed at which a crash at the facility is to be 
envisaged is lower. In combination this can lead to a slightly larger number of UF 6 containers that 
may be damaged. 

• Due to the larger amount of the fuel in the passenger air plane the fire will be larger. Due to the 
resulting larger plume rise of the released UF 6 the consequences for the surrounding area are 
smaller. 

These two points together result in consequences of a crash of a large passenger plane that are not 
significantly worse than those of a crash of a large military plane. 

It should be noted that since recently all UF 6 cylinders are stored inside, the consequences of an airplane 
crash on cylinders is reduced. 

Chemical consequences 

Based on the results of the analysis in the Safety Analysis Report [10] can be concluded that the 
HF-concentrations due to the worst case airplane crash will not lead to irretrievable damage to eyes and 
lungs of persons that are outside the site borders. Inhalation of the maximal occurring U0 2 F 2 - 
concentration does also not lead to irretrievable health damage. 
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Radiological consequences 

The radiological consequences of the release of UF 6 are on the one hand the contamination of the surface 
of an area around UNL and on the other hand the radiation dose of people in the vicinity. 

As reported in the Safety Analysis Report of UNL, due to the worst case airplane crash (of the above 
mentioned crash possibilities) an area of 2 km in diameter will be contaminated with an alpha-activity 
which is 2 times higher than the natural alpha-activity. The contamination will lead to a trade ban of 
agricultural products in an area of almost 3 km in diameter. This ban is for the first erop of green 
vegetables. There is no need to forbid cattle to pasture because of the low transfer rate of the radioactivity 
to milk or meat. For the longer term no measures need to be taken. 

The maximum radiological dose for persons located at the site fence will be about 1 1 mSv in the first day. 
In the case they stay at the site fence for 50 years the total dose over this period will be maximum 90 mSv 
(see section 1.4). The dose at the most nearby houses is considerably lower. 

6.7 Toxic gases 

In this chapter the risks of the release of toxic gasses are discussed. The risk of the release of toxic gases 
originates from: 

• Toxic gasses from the UNL site 

• Toxic gasses from the surrounding companies (ETNL) 

• Toxic gasses from rail and road transportation. 

In most of the cases the toxic gasses can affect the personnel at the UNL site. The UF 6 -systems do not 
need continues control from the control room. Unavailability of (control room) staff/personnel poses 
therefore no risk for confinement of radioactivity or criticality. 

6.7.1 Toxic gasses from UNL site 

Uncontrolled release of a (large) amount of toxic gasses on the UNL site is possible for the chemicals 
mentioned in Table 6-1. Such release of toxic gasses may cause injuries to persons which are close to the 
incident. Unavailability of (control room) staff/personnel is not likely but poses no risk for confinement 
of radioactivity or criticality. 
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Given the small amounts of toxic chemicals and the distance from the source to the site border, it is not 
likely that the effects of the release of toxic gasses will have any effect for the area surrounding the UNL 
site [10]. 

6.7.2 Toxic gasses from adjacent company (ETNL) 

At the ETNL site several toxic chemicals are available for Standard manufacturing purposes. The earlier 
mentioned outdoor storage at the ETNL site contains the substances mentioned in Table 6-2 in section 
6.3.2. These substances mainly consist of liquids, only in the event of an explosion or wrong mixing a 
toxic gas can originate. This will be in a small amount, on a large distance and will be noticed directly. 
There is no risk for confinement of radioactivity or criticality. 

6.7.3 Toxic gasses from rail and road transportation 

Transport of liquefied gasses take place via the rail road Almelo-Hengelo, the road N743 and the road 
Drienemansweg. The main toxic gas that is transported is the transportation of chlorine by rail [13]. This 
chlorine transport is only a risk when there is a chlorine leakage and the train will stop directly at the 
UNL location. This will be noticed and the UNL personnel can be evacuated when needed. However, in 
case this would lead to unavailability of (control room) staff/personnel this would pose no risk for 
confinement of radioactivity or criticality. The chlorine will also not affect the reactivity control or 
confinement of radioactivity directly. 

6.8 Large grid disturbance 

A safety principle applied in the design of a URENCO Centrifuge Enrichment Facility is that UF 6 
systems revert to a fail-safe state upon power outage or system malfunction. 

Any disruption in the electrical power supply of the centrifuge enrichment facility will lead to coast down 
of centrifuges and shut down of the feed systems. All systems will switch to the fail mode and the UF 6 
inventory will be evacuated. Containment of the UF 6 does not rely upon continued electrical supplies. 
This paragraph is further covered by chapter 5 (Loss of electrical power). 
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6.9 Failure of systems by introducing computer malware 

Computer malware can possibly lead to failure of the overall control system (software/hardware). The 
function of this system is monitoring and alarming concerning the enrichment process. The monitoring 
and control of the process is done in the central control room, where trending is executed and actions are 
initiated after an alarm. The direct control of the process, like the adjustment of e.g. valves, is mostly 
done locally. Failure of the control system can therefore not lead to criticality (which is practically 
eliminated as described in section 1.3, 1) or emission of UF6, as further described below. 

A potential risk of emission of UF6 exists during opening of the UF6-system, which takes place at the 
(dis)connection of feed, product and tail cylinders and during specific actions like maintenance with 
disassembly of components. These are all manual actions without direct interaction with the control 
system. 

Actions which are controlled by the control system and which have a risk of leading to an emission of 
UF6 are the filling and heating of UF6 cylinders. The uncontrolled overfilling of a cylinder and 
subsequently heating of the overfilled cylinder can potentially lead to a hydraulic rupture and therefore to 
an emission of UF6. 

Cylinders (tails and product) are filled in the take-off stations. The weight of the cylinder and therefore 
the UF6 level are continually monitored and when the required weight (and level) is reached an alarm is 
given in the control room. The filling of the cylinder is then stopped. A malfunction in the control system 
could lead to failure of the monitoring and of the alarm. Since the filling of the cylinder is slowing down 
with increased level in the cylinder it is unlikely that the failure is not noticed and no action is taken. The 
overfilling in itself will however not lead to rupture of the cylinder. After the filling the cylinder is 
removed from the take-off station and its weight is measured in a separate place. This is a diverse 
measurement which will detect any overweight. If an overweight is measured, proper action is taken to 
correct this. 

In the unlikely case that no action is taken and the UF6 in the overfilled cylinder is heated to the liquid 
phase, a hydraulic rupture of the cylinder due to volume expansion can happen. However, since the 
process of heating up to liquid UF6 takes place in an autoclave (pressure vessel), the rupture of the 
cylinder will not lead to an emission because the UF6 is confined in the gas tight autoclave. 

The heating of the cylinders in the feed stations is, apart from the mentioned monitoring and alarms, 
equipped with local protection against overheating, which shuts off the heater automatically in case of a 
too high temperature. 
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Because of the above, the malfunctioning of the computerized control system cannot lead to failure of the 
safety functions. 

6.10 Internal f looding 

In chapter 3 (external) flooding is already discussed. The main conclusion is that flooding, due to the 
Weezebeek or by extreme rain fall, does not form a realistic threat to UNL. This paragraph considers 
internal flooding, which can be caused by: 

• Break of a main water pipeline 

• Break of a cooling water pipeline 

• Water from fire extinguishing. 

If an internal flooding occurs, the water spreads across the floors and a localised build up is not deemed 
possible. The most likely effect of flooding within an enrichment plant is loss of electrical supplies. 
Electrical supplies are required for continued operation, but the plant is designed to fail to a safe state 
upon loss of electrical supply (see chapter 5) and does not require cooling. 
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7 Severe accident management 

7.1 Organisation and arrangements of the licensee to manage accidents 
7.1 .1 Organisation of the licensee to manage the accident 

Staffing during normal operation 

During normal business hours (Monday-Friday: 07.30 -18.00) on average 60 people are present in the 
offices and about 90 people in production activities (day shift). In addition, about 60 people from outside 
firms are present at the UNL site during this part of the day. In the continuous shift (24/7, 5 shifts total) 9- 
14 persons are present. The staff participating in the continuous shifts consists of all emergency response 
fighters which are therefore always present. The first-aiders and emergency staff are present during the 
day shift. The presence of employees and visitors is recorded at the gate. 

UNL is organised according to the scheme presented in Figure 7-1. 



UNL SITE ORGANISATION 





Security (SEC) 



Exscutivs Secretariat 



Communications & PR 



Senior Advisor 



5P5 Project Manager 

\ / 



^^^^^^^^^^^^^^ 




Figure 7-1 



UNL site organisation 
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Access 

The main entrance to the Drienemansweg is accessible via the main road Almelo - Hengelo. The 
guardhouse at the main entrance is constantly occupied by staff. For emergencies, the complex has an 
entrance through its sister company ETNL. Each building has its own entrance with a fire panel. 

Location 

The UNL site is part of the industrial area "Bornsestraat - Drienemanslanden", situated on the south-east 
of Almelo. Around the complex a doublé fencing is installed. The site boundaries are formed by the 
Drienemansweg, Bavinkelsweg, the Weezebeek and a branch thereof. 

Emergency Plan 

The emergency plan of UNL {Bedrijfsnoodplan) specifies how its obligations arising from the Health and 
Safety Act (Arbo-wet) and the Nuclear Energy Act (KeW vergunning) is included within its organization. 
The emergency plan is tuned to the national emergency organization as is defined in the National Plan 
Nuclear Emergency Response (Nationaal Plan Kernongevallenbestrijding). 

The emergency plan is a description of the organization, procedures and measures, taken by UNL to 
minimize the consequences of an incident or calamity. These are incidents or emergencies that can 
reasonably occur at the UNL site. 

Crisis Plan 

In case of serious consequences an incident may be scaled up from the emergency plan to management by 
the crisis management team. The method used by the crisis management team of UNL is described in the 
Crisisplan Urenco Nederland BV. The crisis management team (CMT) is formed in case of incidents 
involving more serious consequences such as serious personal injury, material damage, environmental 
damage or damage concerning public relations. The crisis plan contains procedures, roles and 
responsibilities of crisis team members and telephone numbers of authorities that should be contacted in 
case of crisis. 

The CMT is the designated single forum in the event of a crisis to ensure that all necessary decisions and 
measures are taken and relevant authorities and relatives of possible victims are informed and consistent 
information to the media is provided. 

The formation of the CMT will depend on the specific nature and extent of the crisis. The CMT can be 
complemented with appropriate specialists when necessary. 
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Crisis center location 

The crisis center is located in the guardhouse (gate Drienemansweg). In the crisis center various resources 
are available 

Training, Exercise and Testing 

Education and training are necessary within the emergency response organization (BHV organisatie). For 
this, courses and training programmes are being followed. The resulting skills are practiced regularly. 

The emergency incident fighters (BHV incidentbestrijding) are trained for various emergency situations 
(firefighting etc). One important part of the training is the support of external assistance (e.g. fire 
brigade). The emergency incident fighters are also being prepared on how to act in the case of a UF 6 
release. 

The head BHV is responsible for the annual training and exercise program to be drawn up and carried out. 
This training program is designed to ensure that all required skills are trained and tested. The results of 
the exercises are evaluated and measures for improvement are suggested. On a yearly basis a professional 
training institution determines whether the members of the emergency response team have the right skills 
and knowledge to perform their task properly. 

7.1 .2 Possibility to use existing equipment 

For UNL the safety functions applicable to the plant and their operation are the criticality prevention and 
confinement of radioactivity. Power supplies are not essential for maintaining UNL plant safety (see 
section 1.3). So compared to an NPP no provisions for emergency situations are necessary. 

In this section the available means and facilities for emergency situations are described. 

Emergency Response Resources 

UNL has several emergency response resources that can be used to fight a calamity in the area of UNL. 
The resources consist of fire-fighting auxiliary tools, emergency showers and personal protective 
equipment. 

Equipment emergency organisation (BHV) 

The staff of the emergency response organisation can extend over the entire premises. However, in order 
to achieve a rapid deployment with the right tools in case of emergency, BHV and first aid posts are 
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divided over the area. The location of the posts is determined in such way that the whole area can be 
controlled and adjusted to the specific risks of that location. 

Fire 

Fire Alarm 

All buildings of UNL have a fire alarm system. The systems are inspected on a yearly basis by a qualified 
inspection body. The inspection body is accredited by the Dutch Accreditation Council (Stichting Raad 
voor Accreditatie). 

Extinguishing 

The buildings of UNL are equipped with fire hose reels, foam and C0 2 extinguishers. The locations of 
these extinguishers are shown on maps of the emergency plan. The maintenance of portable fire 
extinguishers is performed in accordance with NEN 2559 and maintenance of hose reels in accordance 
withNEN-EN 671-1. 

Hydrants and other water extinguishing means 

UNL has a water loop with hydrants which is directly connected to the drinking water network of the 
pipeline network administrator. The normal supply of tap water takes place via the connection to the 
Drienemansweg, but UNL has an independent connection at the Bavinkelsweg. As secondary and tertiary 
fire fighting water facility the water stream De Weezebeek is suitable. 

Other facilities 

Ventilation systems 

Most buildings are equipped with ventilation systems. These can be switched on or turned off by: 

• switches on the fire panels 

• separate switches in the "ventilation rooms". 

An emergency ventilation system is activated when a "high alarm" is given for UF 6 detection (see section 
7.3.1). 

7.1 .3 Evaluation of factors that may impede accident management and respective 
contingencies 

When the crisis plan at the UNL site is actuated, the crisis center in the guardhouse at the gate 
Drienemansweg will be used. In the crisis center divers (communication) facilities are available (see 
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section 7.1.1). When the Drienemansweg can not be reached via the main road Almelo-Hengelo due to 
obstacles or damages, an alternative arrival road to the area is via the Bavinkelsweg at the south of the 
UNL site. An alternative entrance to the UNL site is available via the area of sister company ETNL. 

After (the automatic) shut down of the plant, it is not needed to monitor and control the safety functions 
confinement and criticality. The task of the emergency responders is to prevent the plant for (more) 
accidental conditions like high temperatures caused by fire or the collapse of relevant buildings (risk of 
damage to UF 6 pipes and cylinders). 

Power supplies are not essential for maintaining UNL plant safety (see section 1.3). 

7.1 .4 Conclusion on the adequacy of organisational issues for accident management 

UNL has an emergency plan which can be scaled up for management by the crisis management team. The 
site can be reached by alternative routes. UNL has an emergency response organisation with sufficiënt 
means to fight different calamities. The emergency fighters are periodically trained for various emergency 
situations. 

7.2 Maintaining the safety functions 

7.2.1 Prevention of loss of containment integrity 

In section 1.3.3 the principal controls and safeguards to prevent or mitigate release of radioactivity are 
described. The fundamental safety principle when processing UF 6 is to maintain containment at all times 
during normal operations and to design and operate the plant so as to minimize the potential for a 
significant release in fault conditions, through isolation and safe removal of process gas. Any plant 
discharges are via appropriate traps or filtration and monitoring systems before release through authorized 
routes to the environment. When handling uranium contaminated materials outside containment, area 
ventilation and contamination control together with monitoring become the means of confinement. 

7.2.2 Prevention of criticality 

The principal controls and safeguards to prevent and mitigate criticality are described in section 1.3.1. 
Due to the design of systems and equipment the potential for criticality is practically eliminated. In the 
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improbable situation that criticality does occur, this will be a short event and severe consequences are 
limited to people in the vicinity of the criticality accident (order of magnitude of a few meters). 

7.2.3 Conclusion on the adequacy of severe accident management systems for 
maintaining the safety functions 

In relation to confinement and subcriticality control of UF6, the design of equipment and plant 
installation and the operation of the plant show to be adequate. The emergency response organization is 
prepared and equipped in case of accident conditions. 

7.3 Accident management measures to restrict releases 

7.3.1 Radioactive releases after loss of containment integrity 

The main radioactive materials present on the UNL site are UF 6 and its breakdown products. UF 6 may be 
present in solid, liquid or gaseous form. Various contaminated substances are present including oils, 
residues and trap and filter media. If UF 6 is released or exposed to moist air it produces HF gas which 
together with the UF 6 can disperse on and off-site. The main breakdown product, uranyl fluoride, is solid. 

In areas where a release of UF 6 could occur a detection system is present. When UF 6 is detected an alarm 
is given in the room itself and a signal is given to the control room. In case of "high alarm" the 
emergency ventilation system is automatically activated and releases are filtered. For large releases alarm 
is given via the alarm protocol. 

For repair of damaged UF 6 cylinders special repair cases are composed including several tools, 
equipment and personal protection means. 

The emergency plan of UNL describes at what locations emergency equipment is available for treatment 
of persons with exposure to radioactive materials as well as descriptions of the consequences and the way 
of treatment. 

7.3.2 Chemical releases resulting f rom released UF 6 after loss of containment integrity 

Release of chemical substances is linked to the release of UF 6 . In the former section the restriction of UF 6 
(with accompanying chemical reaction products) release is treated. 
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UF 6 and HF are both substances that are corrosive and affect eyes, skin and respiratory organs. Exposure 
to high concentrations or for prolonged periods, may cause permanent damage. 

The emergency plan of UNL describes at what locations emergency equipment is available for treatment 
of persons with UF 6 , HF and UO2F2 exposure as well as descriptions of the consequences and the way of 
treatment. 



7.4 Measures which can be envisaged to enhance capability to maintain 
safety functions and restrict releases 

No measures to enhance the capability to maintain safety functions and restrict releases are considered 
necessary. 
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AC Alternating Current 
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SP Separation Plant 

SSC Structure, System and/or Component 

SUB Site Utility Building 

TGB Technische Grondslagen voor Bouwconstructies 

UF 6 Uranium hexafluoride 

UNL URENCO Netherlands BV 

UOB UNL Office Building 

UO2F2 Uranyl Fluoride 

UPS Uninterruptable Power Supply 
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Appendix A Reference table between the "Frageliste der 

ESK" and the UNL report 

As agreed with the Ministry of Economie Affairs, Agriculture and Innovation (EL&I), a reference table is 
included between the underlying UNL report and the guidelines for the stress test applicable for the 
German Urenco site. These guidelines are the „Frageliste der ESK für den Stresstest für die 
Anlagenkategorien 1, 3 und 6, 29.05.2012". 



ESK Fragenliste 


UNL report 


A Zu Erdbeben 


2 Earthquake 


B Zu Hochwasser 


3 Flooding 


C Zu Starkregen 


4 Extreme weather conditions 


D Zu sonstigen wetterbedingten Ereignissen 


4 Extreme weather conditions 


E Zum Ausfall der elektrischen Energieversorgung 


5 Loss of electrical power 


F Zu anlageninternem Brand 


6.4 Internal fire 


G Zu Branden auRerhalb der Anlage 


6.5 External fire 


H Zu Flugzeugabsturz 


6.6 Airplane crash 


1 Zur Explosionsdruckwelle 


6.2 Internal explosion 

6.3 External explosion 



The reference table above shows that all hazards that are part of the German stresstest are included in the 
UNL report. Above this, the UNL report has evaluated a few additional hazards. The UNL report further 
has a chapter 7 on "Severe Accident Management". This has a relation with the item 
"NotfallmaBnahmen" within each of the German sections. 
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